Chapter 10

ISIS Digital and Strategic Communications Tool Kit

There are two primary purposes for which cyber jihadists use digital tool kits: Communications and Security.

COMMUNICATIONS

Key to ISIS activities is their ability to broadcast across the organization and out to the world. With use of smartphone apps, social media sites, and free file hosting, the organization exploited most of the commonly available online communication tools.

End-to-End Communication

Terrorist organizations have an urgent need for apps that enable them to communicate. In order to recruit, conduct operations, or inform the followers of the latest events or expectations, these groups need the technical means to do so without all the trappings found in account setups, cell phone accounts, or email communications. The prime pick of apps used for end-to-end communications by summer of 2016 were Telegram, WhatsApp, Surespot, and Signal. Communication tools are picked based on the belief that they are secure end-to-end communications. When news hits the mainstream technical magazines of a breach or vulnerability, ISIS and other groups grow suspicious and often migrate to a new platform for communications.

Propagation

The second need was to propagate the message of the caliphate to targeted audiences. This might include their current or potential cult members or the broader international audience. Entries on Telegram channels may contain attached downloads or, just like JustPaste.it posts, offer direct links to the latest videos on Archive.org, Google Drives, and other file sharing sites. This gives supporters alternative ways to share the ISIS materials widely in order to guarantee access. They must accomplish this in the face of a constant effort to take down these materials by both government efforts and grassroots activist intervention.

Apps like Amaq or al-Bayan radio make the latest news headlines from ISIS available. Need to know what the latest da’wah campaign is doing? Or need to know the latest news out of Syria? There’s an app for that. Communication between operatives or from ISIS or AQ central to followers requires using a great many of the tools in the cyber jihadist tool kit.

Examples: Telegram was both an end-to-end messenger and an online location on which one could read the latest discussion, news, and announcements from ISIS, AQ, and other organizations. Due to the addition of channels, Telegram has in many ways replaced the jihadist website of years gone by. As the takedown efforts of Twitter started to have their effect, users were migrating to Telegram to get the latest information. For some leaders in the media department, Twitter is still recommended as an effective means to propagate the ISIS message on the Surface Web.

Community

A major component of web usage by international terrorists was the need to form bonds. Ironically, the need to avoid detection by legal authorities runs into the need of the terrorist community to identify and express itself in ways no different from the ones that subcultures around the world employ to express themselves. For instance, the sharing of pro-ISIS humor that may upset Americans or Europeans quickly elicits unifying laughter from followers on Twitter or Telegram. This “humor” has included superimposing leaders’ heads over a doomed captive facing beheading or one particularly upsetting graphic in which injured US soldiers were mocked by ISIS followers on a Telegram channel.

There was a clear need for community in the communications of ISIS. The us-versus-them language was rampant, and the target-of-the-day postings are meant to unify a powerful and targeted resentment. It also serves to further unify the ISIS followers who enjoy being in on the “jihadi-cool” found in much of the chatter on Telegram and Twitter, as true believers in the ISIS cause enjoy the same punchlines at the expense of the disbelievers or the apostates. They share in the glee of the fall of their enemies and the worship of their dead fighters. Whether Telegram or Twitter, the app tools help to foster a sense of community.

Commentary

Apps are used to participate in the many political discussions of the world, enlivened by comments with a slant only ISIS followers could provide. This includes discussions on breaking news events—the attempted coup in Turkey, downed airliners, or domestic events in countries that can be spun into validation of the caliphate’s goals. It is also where the followers of these groups turn to for the latest message from ISIS or AQ officials or to enjoy the irreverent postings against the disbelieving kufar. ISIS keeps up with American and European news and often comments on the headlines along with graphics posted in Telegram channels taken from cell-phone screen shots.

THE NEED FOR SECURITY

The other imperative for using the tools available was to provide security. While almost all the tools have some application to maintaining security, there are specific uses for certain tools, in particular the ones used for encrypting messages or ones used for eluding detection, leaving no footprint, and destroying materials to prevent the opposition from obtaining them.

The level of support for an app was dictated by the perceived security of the tools being used to conduct these activities. When security was perceived to be an issue for a forum online or for an app on a phone, ISIS/AQ media warnings follow and migrations to other tech options occur. It was very common to have tech tools discarded quickly upon the mere speculation that intel agencies had a hand in making them.

ISIS-related tech groups and channels keep up with conventional tech columns and forums, specialists’ Twitter accounts, and news flashes that let them know what is currently happening in the technology realm and subsequently advise the ISIS faithful to follow new recommendations. In some cases, posts made on Twitter by recognized tech experts wind up as Telegram posts within minutes, with news on encryption, net security, hacking, or other security matters.

Terrorists also pay attention to what happens to their own followers after an operation. Trend Micro, a cyber security firm, noted a decline in the usage of Facebook’s communications app, WhatsApp, after arrests led to investigations of the usage of the web tool by terrorist suspects.1

Potential targets of investigation are very aware of the use of metadata to capture them or their colleagues. In one example, noted in the Boston beheading plot of June 2015, David Wright was alleged by prosecutors to have been told by Usama Rahim to destroy the phone and wipe the laptop clean by resetting and clearing the hard drive.2

THE ISIS-APPROVED MOBILE PHONES

“(duh…Please don’t attempt to make hijra if your parents confiscated your phone),” reads the Hijrah guide produced by ISIS. The “Hijrah to the Islamic State” publication purportedly put out by ISIS states: “Also remember to never use iPhones, Androids are securer.”3 It also says “Buy a SIM card at the airport, but don’t buy any SIM card, buy a Turkcell SIM card.” After you’ve done this, of course you have to call the “Office of Borders of Dawlah,” the guide continues.

It’s clear that ISIS and AQ use a range of tools based on availability. There are preferences based on user recommendations and security considerations. Then there are phones actually confiscated. The largest group of users are on Android phones, and some are on iPhone. The preferences of phone are limited by availability, so it was not possible for ISIS to maintain a steady operation in terms of equipment. In the Paris attacks of November 2015, a Samsung smartphone was used.4 Weeks later in San Bernardino, Saed Rizwan Farouk was using an iPhone 5c provided by the county agency he worked for when he and his wife attacked coworkers on December 2, 2015. The phone was under a password-protected lock, and after strenuous attempts by the US government to make Apple Inc. provide access, the FBI announced on March 28, 2016, that it had successfully unlocked the phone.

Phones can be used not only for texting on apps, but for sending voice messages, a common way followers seek to avoid detection, since there will be no metadata to read from the audio file. One mother, Karolina Dam, even had a friend of her son’s play back messages from him seeking to recruit him into ISIS. Her son, Lukas, died in Syria, and she kept in touch with him via the messaging app Viber until he died in Syria.5